/var continously increasing disk usage

[noelski]

On my system, bdf output says that /var has used up 86% with disk usage of 2.6GB.But if I use du -kx on /var, it says that the whole /var folder only used around 650MB.So what could have possibly eat up the 2GB disk space?Kindly see output below.

$ bdf|grep /var
/dev/vg00/lvol8 3080192 2642616 437576 86% /var


$ sudo du -kx /var|sort -rn|more
Password:
657592 /var
236816 /var/opt
189928 /var/adm
147952 /var/adm/sw
132136 /var/adm/sw/products

[Matti_Kurkela · Accepted solution]

> So what could have possibly eat up the 2GB disk space?

A file that was deleted when it was (and still is) in use by some process.

If you have the (very useful, free) lsof utility installed, run "lsof +L1" to see deleted files that are still in use.

Example:
$ root lsof +L1
[sudo] password for mkurkela:
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NLINK NODE NAME
firefox-b 4313 mkurkela 49w REG 254,2 3251810 0 475172 /home/mkurkela/.mozilla/firefox/80dpes3s.default/XPC.mfasl (deleted)

Here, XPC.mfasl is a file that is about 3.2 MB in size, and although it has been deleted, it is still being used by Firefox. Once Firefox is shut down, it will be automatically cleaned up by the OS, and the 3.2 MB of disk space it's currently occupying will become free again.

This is actually a legitimate programming technique: to make sure a sensitive temporary file won't be left around even if a program crashes, a programmer may make the program delete a temporary file as soon as it's been opened. This way, any POSIX-compliant system will automatically remove the temporary file as soon as the file is closed for any reason... including the program crashing.

MK